To: 


Of: 


İCO. 


Information Commissioner's Office 


DATA PROTECTION ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


Finance Giant Ltd 
6th Floor, 25 Farringdon Street, London, EC4A 4AB 


The Information Commissioner (“the Commissioner”) has decided to 

issue Finance Giant Ltd (“FGL”) with a monetary penalty under section 
55A of the Data Protection Act 2018 (“DPA”). The penalty is in relation 
to a serious contravention of Regulations 22 and 23 of the Privacy and 


Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner's decision. 


Legal framework 


FGL, whose registered office address is given above (Companies House 
Registration Number: 09749034) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 
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"(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Regulation 23 of PECR states that “A person shall neither transmit, nor 


instigate the transmission of, a communication for the purposes of 


direct marketing by means of electronic mail - 


(a) where the identity of the person on whose behalf the 
communication has been sent has been disguised or 


concealed; 


(b) where a valid address to which the recipient of the 
communication may send a request that such 


communications cease has not been provided 


(c) where that electronic mail would contravene regulation 7 of 
the Electronic Commerce (EC Directive) Regulations 2002; 


or 


(d) where that electronic mail encourages recipients to visit 


websites which contravene that regulation.” 


Section 122(5) of the Data Protection Act 2018 (“DPA18”) defines 
direct marketing as “the communication (by whatever means) of 
advertising or marketing which is directed to particular individuals”. 
This definition also applies for the purposes of PECR (see regulation 
2(2) PECR and paragraphs 430 & 432(6) to Schedule 19 of the DPA18). 


“Consent” is defined by regulation 8(2) of the Data Protection, Privacy 
and Electronic Communications (Amendments etc) (EU Exit) 
Regulations 2019 by reference to the UK General Data Protection 
Regulation (“GDPR”), article 4(11) of which provides that: “'consent’ of 
the data subject means any freely given, specific, informed and 
unambiguous indication of the data subject's wishes by which he or he, 
by a statement or by a clear affirmative action, signifies agreement to 


the processing of personal data relating to him or her”. 
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Recital 32 of the GDPR materially states that “When the processing has 
multiple purposes, consent should be given for all of them”. Recital 42 
materially provides that “For consent to be informed, the data subject 
should be aware at least of the identity of the controller”. Recital 43 
materially states that “Consent is presumed not to be freely given if it 
does not allow separate consent to be given to different personal data 


processing operations despite it being appropriate in the individual case”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail” is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient's terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


The term "soft opt-in" is used to describe the rule set out in in 
Regulation 22(3) of PECR. In essence, an organisation may be able to 
e-mail its existing customers even if they haven't specifically consented 
to electronic mail. The soft opt-in rule can only be relied upon by the 


organisation that collected the contact details. 


Section 55A of the DPA (as applied to PECR cases by Schedule 1 to 


PECR, as variously amended) states: 
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“1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 
(2) This subsection applies if the contravention was deliberate. 
(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that the 


contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR were enacted to protect the individual’s fundamental right to 
privacy in the electronic communications sector. PECR were 
subsequently amended and strengthened. The Commissioner will 
interpret PECR in a way which is consistent with the Regulations’ 
overall aim of ensuring high levels of protection for individuals’ privacy 


rights. 
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The provisions of the DPA remain in force for the purposes of PECR 


notwithstanding the introduction of the DPA18: see paragraph 58(1) of 
Schedule 20 to the DPA18. 


Background to the case 


FGL is a private limited company incorporated in England on 25 August 
2015 (company number 09749034). The address of its registered office 
is 6" Floor, 25 Farringdon Street, London, EC4A 4AB. FGL acts as a 
loan broker for individuals seeking car finance. Its primary website is 


presently carfinancegiant.co.uk. 


FGL is registered with the Financial Conduct Authority (‘FCA’) to carry 
out regulated services (reference number 726597) and with the 
Commissioner’s Office as a Tier 1 data controller (registration number 
ZB191170). 


FGL came to the attention of the Commissioner during the second 
lockdown (between 5 November and 2 December 2020) imposed as a 
result of the Covid-19 pandemic. In this period, the Commissioner 
received 97 complaints from individual subscribers of unsolicited direct 


marketing SMS messages containing the following text: 


Marketplace CRASHED! Over 320,000 cars prices DROPPED due 
to 2" lockdown. Best time to upgrade - 


https://carfinancegiant.co.uk/cars Good Luck! CFG 


The messages were reported to the Commissioner through the 7726 
spam reporting system indicating that the SMS messages in question 
were sent without the subscribers consent. The SMS messages also did 


not contain an opt-out. 
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On 24 November 2020, the Commissioner’s office FGL to notify it that 
the Commissioner was investigating FGL’s compliance with the PECR, 
including the actions of individual directors and officers of the company 
to determine their liability. Attached to the email was a letter which 
asked FGL to provide various items of information concerning its SMS 


messaging activities between 1 January and 24 November 2020. 


On 22 December 2020, FGL replied to the Commissioner’s request for 


information, stating materially that: 


a. FGL had sent no text messages to customers between 1 
January and 31 October 2020 but that it had sent 40,524 text 
messages to individual customers and 465,241 emails to 


72,483 customers in November 2020; 


b. all the text messages sent by FGL in November 2020 were 
identical, stating: “Marketplace CRASHED! Over 320,000 cars 
prices DROPPED due to 2nd lockdown. Best time to upgrade - 
https://carfinancegiant.co.uk/cars Good Luck! CFG”. The text 
of the emails sent by FGL stated: “Want to upgrade your car? 


Over 320,000 car prices reduced”. 


c. the data had been obtained by FGL directly from its 
customers. The texts were sent only to customers “who 
applied for finance through our website and accepted our T&C 
and Privacy policy which covers our marketing 


communication"; 


d. asked to provide evidence that individual customers had given 
their consent, FGL stated that customers were “unable to 
submit the application until they tick the box that they agreed 
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with T&C and we direct the customers to read our privacy 


policy”, and 


e. asked to confirm whether it operated an internal suppression 
list of numbers in circumstances where it had been advised 
that the subscriber did not wish to receive marketing 
communications, FGL stated that “We relied on the platform 
we use to offer customers an option to stop any future text 
messages etc. We were concerned when we received an 
inquiry from ICO. This highlighted that perhaps customers 
were not provided with an option which may have led to the 


customers lodging a complaint with ICO. As a result, we 
raised a query with the platform providers" [emphasis added]. 


FGL attached a response from the platform providers, stating 
that an opt out was “not included automatically” but could be 
added. 


At this time, FGL also provided the Commissioner’s office with 
screenshots of the application process, a copy of the emails sent to 
customers, a copy of FGL’s terms and conditions and a link to its 


privacy policy. It also stated that its staff completed an online GDPR 


training course provided by the JE 


On 23 December 2020, the Commissioner's office asked FGL to (i) 
clarify how many of the text messages and emails it were successfully 
delivered to individuals; and (ii) supply the name of the platform FGL 
used to send text and email messages. It also drew FGL’s attention to 
the Commissioner’s Direct Marketing Guidance, including the 
requirement that electronic direct marketing messages necessitate 
consent. On 18 January 2021, FGL provided the further information as 


requested, showing that the rate of successful delivery for SMS was 
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68.13% and the corresponding rate in relation to emails was in excess 
of 90%. 


On 29 January 2021, the Commissioner’s office sought further 
clarification of the numbers of texts and emails sent to individual 
customers. On 8 February 2021, FGL provided the further information 
sought. 


On 4 March 2021, the Commissioner’s office notified FGL that it had 
completed its investigation and would now consider whether to take 
formal enforcement action. It invited FGL to provide any further 
evidence or information regarding its policies, procedures and training 


programmes within 7 days. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulations 22 and 23 of PECR by FGL and, if so, 


whether the conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that FGL contravened regulations 22 and 23 of 
PECR. 


The Commissioner finds that the contravention was as follows: 


The Commissioner finds that between 1 and 30 November 2020 there 
were (i) 40,524 direct marketing SMS sent and 27,608 direct 
marketing SMS received by subscribers; and (ii) 465,235 direct 
marketing emails sent and 445,138 direct marketing emails received 
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by subscribers. The Commissioner finds that FGL transmitted those 


direct marketing messages via the sendinblue.com platform, contrary 
to regulation 22 of PECR. 


FGL as the sender of the direct marketing is required to ensure that it 
is acting in compliance with the requirements of regulation 22 of PECR, 
and to ensure that valid consent to send those messages had been 


acquired. 


In this instance, FGL claimed that its customers had consented to 
receiving direct marketing messages as part of their agreement to the 
terms and conditions and privacy policy during the application process. 
However, FGL’s application process enables applicants only to signify 
their agreement to the terms and conditions. There is no separate opt- 
in or opt-out box to enable applicants either to consent or withdraw 
consent specifically in relation to direct marketing messages. Nor are 
applicants informed that direct marketing messages will be sent, unless 


they separately consult the terms of FGL’s privacy policy. 


The Commissioner’s Direct Marketing Guidance makes clear that 
“organisations need to be aware that indirect consent will not be 
enough for texts, emails or automated calls. This is because the rules 
on electronic marketing are stricter, to reflect the more intrusive nature 
of electronic messages”. Indirect consent may only be valid where it is 
sufficiently clear and specific. For consent to be valid it is required to 
be “freely given”, by which it follows that if consent to marketing is a 
condition of subscribing to a service, the organisation will have to 
demonstrate how the consent can be said to have been given freely. 
Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 


organisation, that will be sending it. 
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Having regard to the above, the Commissioner concludes that the 
consents obtained by FGL as part of the application process did not 


meet the requirements of PECR in respect of direct marketing 


messages. Specifically: 


a. consent was not informed because individuals were not 
notified during the application process that marketing 


messages would be sent; 


b. consent was not specific as there was no indication as to the 


type of marketing communication that would be sent; and 


c. consent was not freely given because it was required as a 


condition of making an application. 


The Commissioner is therefore satisfied from the evidence he has seen 
that FGL did not have the necessary valid consent for the 27,608 direct 
marketing SMS and 445,138 direct marketing emails received by 


subscribers in November 2020. 


The Commissioner is further satisfied that the actions of FGL have 
contravened regulation 23 PECR, in that the 27,608 direct marketing 
SMS did not contain any opt-out to enable customers to stop receiving 
further messages. The Commissioner acknowledges that the 445,138 


direct marketing emails did include such an opt-out. 


The Commissioner has gone on to consider whether the conditions 


under section 55A DPA are met. 
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Seriousness of the contravention, 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 1 and 30 November 2020 
a confirmed total of 505,759 direct marketing messages were sent by 
FGL. These messages contained direct marketing material for which 


subscribers had not provided valid consent. 


In assessing the seriousness of the contravention, the Commissioner 


also has regard to the following matters: 


a. there was no way for applicants to avoid consenting to the 


FGL’s use of direct marketing messages as part of the 
application process other than by declining the service 


altogether; 


. the implications of FGL’s terms and conditions - including the 


use of direct marketing messages - were never made clear to 


applicants at the application stage; 


. the text messages sent by FGL referenced the Covid-19 


pandemic, in an attempt to capitalise on an apparent crash in 


the market to increase sales; and 


. the text messages did not contain an opt-out as required by 


regulation 23 PECR. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 
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Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 
above was deliberate. In the Commissioner’s view, this means that 
FGL’s actions which constituted that contravention were deliberate 
actions (even if FGL did not actually intend thereby to contravene 
PECR). 


The Commissioner considers that in this case FGL did deliberately 
contravene regulations 22 and 23 of PECR. FGL’s privacy policy 
expressly stated that individuals would only receive marketing should 
they consent to it, and that individuals would be able to choose which 
channel they would want to receive marketing. FGL were, therefore, 
plainly aware of the requirements for obtaining valid consent for 
marketing. The application process on FGL’s website did not reflect its 
privacy policy. Applicants were instead required to consent to direct 
marketing messages as part of its terms and conditions, nor were 
individuals properly informed of this during the application process. 
FGL’s privacy policy shows that it knew what was required but chose to 


ignore those requirements when it came to the application process. 


For the above reasons, the Commissioner is satisfied that this breach 


was deliberate within the meaning of s55A(2). 


Further and in the alternative, the Commissioner has gone on to 
consider whether the contravention identified above was negligent. 


This consideration comprises two elements: 


Firstly, he has considered whether FGL knew or ought reasonably to 
have known that there was a risk that these contraventions would 


occur. He is satisfied that this condition is met, in light of the content of 
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FGL’s own privacy policy which recognised the need for valid consent. 


In light of those FGL cannot have been unaware that a failure to follow 


its own privacy policy might give rise to a risk of contravention. 


The Commissioner has published detailed guidance for those carrying 
out direct marketing explaining their legal obligations under PECR. 

This guidance gives clear advice regarding the requirements of consent 
for direct marketing and explains the circumstances under which 
organisations are able to carry out marketing over the phone, by text, 
by email, by post, or by fax. In particular it states that organisations 
can generally only send, or instigate, marketing messages to 
individuals if that person has specifically consented to receiving them[; 
and highlights the difficulties of relying on indirect consent for 
electronic mail]. The Commissioner has also published detailed 
guidance on consent under the GDPR. In case organisations remain 
unclear on their obligations, the ICO operates a telephone helpline. ICO 
communications about previous enforcement action where businesses 


have not complied with PECR are also readily available. 


It is therefore reasonable to suppose that FGL should have been aware 


of its responsibilities in this area. 


Secondly, the Commissioner has gone on to consider whether FGL 
failed to take reasonable steps to prevent the contraventions. Again, he 
is satisfied that this condition is met. Specifically, there is no evidence 
that FGL took any steps to implement the requirements of its privacy 
policy as part of its application process. Nor did it offer any evidence 
that it sought to include an opt-out in relation to the SMS direct 
marketing messages, even though this option was available on the 
platform it used. FGL, moreover, had no tangible policies or procedures 


relating to the PECR to ensure that its marketing would comply with 
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those requirements. Nor is there any evidence that FGL changed its 


website to reflect the enforcement action. 


50. Inthe circumstances, the Commissioner is satisfied that FGL failed to 


take reasonable steps to prevent the contraventions. 


51. The Commissioner is therefore satisfied in the alternative that FGL 
failed to take reasonable steps to prevent the contravention as 
required by section 55A(3) DPA. 


The Commissioner’s decision to issue a monetary penalty 


52. The Commissioner has taken into account the following 


aggravating features of this case: 


e the actions of FGL were clearly motivated by the desire to increase 
its customer base during the pandemic and generate additional 


profit; and 


e FGL ignored the guidance issued by the Commissioner’s Office in 
relation to direct marketing, as well as the helpline operated by 
the Office to assist businesses seeking clarification of their 
obligations under the PECR. 


53. The Commissioner has taken into account the following mitigating 


features of this case: 


e FGL ceased electronic marketing following notification of the 
Commissioner’s investigation, nor is the Commissioner aware of 


any further complaints or concerns; and 
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e FGL indicated that it had take legal advice to ensure further and 


ongoing compliance with the PECR. 


For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. He is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out his preliminary thinking and invited FGL to make 
representations in respect of this matter. In reaching his final view, the 
Commissioner has taken into account the representations made by FGL 


on this matter. 


The Commissioner is accordingly entitled to issue a monetary penalty in 
this case. 


The Commissioner has considered whether, in the circumstances, he 


should exercise his discretion so as to issue a monetary penalty. 


The Commissioner has considered the likely impact of a monetary 
penalty on FGL. He has decided on the information that is available to 
him that a penalty remains the appropriate course of action in the 


circumstances of this case. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited direct marketing messages is a matter of significant public 
concern. A monetary penalty in this case should act as a general 
encouragement towards compliance with the law, or at least as a 


deterrent against non-compliance, on the part of all persons running 
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businesses currently engaging in these practices. The issuing of a 
monetary penalty will reinforce the need for businesses to ensure that 


they are only messaging those who specifically consent to receive 


direct marketing. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £60,000 (sixty thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 11 May 2022 at the latest. The monetary 
penalty is not kept by the Commissioner but will be paid into the 
Consolidated Fund which is the Government’s general bank account at 
the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
10 May 2022 the Commissioner will reduce the monetary penalty by 
20% to £48000 (forty eight thousand pounds). However, you should 
be aware that the early payment discount is not available if you decide 


to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


64. 


65. 


66. 


67. 


İCO. 


Information Commissioner's Office 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 
unless: 
e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In Scotland, 
the monetary penalty can be enforced in the same manner as an extract 
registered decree arbitral bearing a warrant for execution issued by the 


sheriff court of any sheriffdom in Scotland. 


Dated 11 April 2022 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 SAF 
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ANNEX 1 
SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


1. Section 55B(5) of the Data Protection Act 1998 gives any person 
upon whom a monetary penalty notice has been served a right of 
appeal to the First-tier Tribunal (Information Rights) (the ‘Tribunal’) 


against the notice. 
2. If you decide to appeal and if the Tribunal considers:- 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of 
discretion by the Commissioner, that he ought to have exercised 


his discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the 


Tribunal at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 

LE1 8DJ 
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Telephone: 0203 936 8963 
Email: grc@justice.gov.uk 


a) The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 

b) If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 
rule. 


The notice of appeal should state: - 


a) your name and address/name and address of your 


representative (if any); 


b) an address where documents may be sent or delivered to 


you; 

c) the name and address of the Information Commissioner; 
d) details of the decision to which the proceedings relate; 
e) the result that you are seeking; 

f) the grounds on which you rely; 


g) you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 


h) if you have exceeded the time limit mentioned above the 


notice of appeal must include a request for an extension of time 
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and the reason why the notice of appeal was not provided in 


time. 


5; Before deciding whether or not to appeal you may wish to consult 
your solicitor or another adviser. At the hearing of an appeal a party 
may conduct his case himself or may be represented by any person 


whom he may appoint for that purpose. 


6. The statutory provisions concerning appeals to the First-tier 
Tribunal (Information Rights) are contained in section 55B(5) of, and 
Schedule 6 to, the Data Protection Act 1998, and Tribunal Procedure 
(First-tier Tribunal) (General Regulatory Chamber) Rules 2009 
(Statutory Instrument 2009 No. 1976 (L.20)). 
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